AWS, Mumbai
The database, recordings and the services that run your agents are on AWS in the Mumbai region.
Trust
How Govodo looks after your data.
What is in place today, described plainly — including what we have not built yet. The details behind each point are in our privacy policy.
Hosting and storage
Stored in India, encrypted at rest.
Private, encrypted recordings
Call recordings are kept in a private storage bucket with public access blocked and AES-256 encryption at rest.
Encrypted in transit
The site, the console and the API are served over HTTPS only.
Kept for 90 days
Recordings, transcripts, messages and caller memory are deleted automatically after 90 days. Leads, invitees and bookings stay until you delete them.
Only the scripts we chose
The site, the console and the admin portal tell your browser to refuse any script except our own and, in production, Google Analytics. They also tell it never to load our pages inside another site.
No advertising trackers
No advertising or social-media trackers. In production, Google Analytics counts visits, without your name or account. See the cookie policy.
Storage is in India. Speech recognition, voices and language models are provided by specialist providers, some of which process data outside India. They are listed in the privacy policy.
Access
Each workspace sees only its own data.
Workspaces kept apart
Every request is checked against the workspace it belongs to. Asking for another workspace's agents, calls or recordings gets "not found", and automated tests hold that line.
Roles
Owners and admins manage people, keys and settings. Members use the console without changing who can get in.
Platform staff
Scrini's platform administrators can open workspaces to run and support the service.
Keys and secrets
Stored so that a leak is not a key.
Passwords
Stored as salted bcrypt hashes. Nobody at Scrini can read your password.
API keys
Shown once and stored only as a hash. Each can be scoped, given an expiry and revoked. Every request made with one is logged.
Carrier and account credentials
Phone-carrier credentials, the tokens for accounts you connect, and AI provider keys are encrypted before they are stored.
Calls and carriers
Only your carrier can start a call on your number.
Verified carrier requests
A request from a carrier must carry your workspace's key, a token for that one call, and the carrier's own signature.
Signed webhooks
Every webhook Govodo sends you is signed with HMAC-SHA256, so you can check it came from us.
Checked WhatsApp messages
Incoming WhatsApp messages are refused unless Meta's signature on them checks out.
Calling people responsibly
The tools to call within the rules.
The rules on calling, recording and AI voices depend on where you and the people you call are. Following them is your responsibility, as our terms set out. These features help.
Do not call, kept
Once someone asks not to be called again, campaigns and the call queue skip that number in your workspace from then on.
Calling hours
An agent's campaign and queued calls can be limited to set days and hours, in a timezone you choose, with dates to skip.
Recording is your choice
Calls are recorded by default. You can turn recording off, and you write the opening line, so you choose how callers are told.
Not built yet
What we are still working on.
So that nothing on this page is taken to mean more than it does:
Two-factor sign-in and SSO
Sign-in is email and password today.
Deleting data yourself
Conversation data is deleted after 90 days. Deleting it sooner is done by our team on request, not yet from the console.
An audit log
Use of API keys is logged. A full log of what people do in the console is not available yet.
Report a security issue
Found something? Tell us first.
Email support@scrini.ai with "Security" in the subject and enough detail for us to reproduce it. Please do not access other people's data, degrade the service or make the issue public before we have fixed it. We will reply, keep you updated and credit you if you would like.